File Investigation Report
MEDIATUBECODEC_VER1.1183.0[n].EXECloaked Malware
Your PC is infected. The file called MEDIATUBECODEC_VER1.1183.0[n].EXE is considered unsafe and there may be other infections on your PC.
You should urgently check your PC and remove any malicious software including MEDIATUBECODEC_VER1.1183.0[n].EXE as soon as possible. The free version of Prevx CSI will scan your PC for millions of spyware and malware infections in less than 2 minutes. Don't put your confidential data, or your identity at risk, check your PC now with Prevx CSI.
Associated Malware Groups
The filename is associated with the malware group:
- Cloaked Malware
File Behavior
MEDIATUBECODEC_VER1.1183.0[n].EXE has been seen to perform the following behavior:
- The Process is polymorphic and can change its structure
- This Process Creates Other Processes On Disk
- Can communicate with other computer systems using HTTP protocols
- Writes to another Process's Virtual Memory (Process Hijacking)
- Executes a Process
- Looks at the contents of the autoexec.bat file
- Reads email address and phone book details
- Visits web sites on your PC without you knowing
- This Process Deletes Other Processes From Disk
- Terminates Processes
MEDIATUBECODEC_VER1.1183.0[n].EXE has been the subject of the following behavior:
- Has code inserted into its Virtual Memory space by other programs
- Executed from Temporary Folders
- Created as a process on disk
- Terminated as a Process
- Executed as a Process
- Registered as a Dynamic Link Library File
Country Of Origin
The filename MEDIATUBECODEC_VER1.1183.0[n].EXE was first seen on Oct 5 2008 in the following geographical regions of the Prevx community:
- URUGUAY on Oct 5 2008
- The UNITED KINGDOM on Oct 5 2008
File Name Aliases
MEDIATUBECODEC_VER1.1183.0[n].EXE can also use the following file names:
- SFT_VER1.1454.0.EXE
- 70750732.EXE
- 17672198.EXE
Filesizes
This file has been seen with the following file size:
- 77,824 bytes
Vendor, Product and Version Information
This file has no vendor, product or version information specified in the file header.
File Type
The filename MEDIATUBECODEC_VER1.1183.0[n].EXE refers to an executable program.
File Activity
One or more files with the name MEDIATUBECODEC_VER1.1183.0[n].EXE creates, deletes, copies or moves the following files and folders:
- Opens/modifes c:\autoexec.bat
- Creates c:\docume~1\user\locals~1\temp\pwrmgr.exe
Website Activity
One or more files with the name MEDIATUBECODEC_VER1.1183.0[n].EXE interacts with the following web sites and pages. Web addresses have been deliberately modified to prevent unintentional use.
- 64 .247 .39 .247 / confirm .php?aid=0&said=0
- s-avirus .com / soft / sa2009 .exe
- Port 80 IP:64.247.39.247
- Port 80 IP:91.203.92.25